Taint and tolerations

Taints are set on Nodes

Tolerations are set on Pods

Taints

Taints are applied to nodes to repel pods that do not have a matching toleration. The following command taints a node so that only pods tolerating app=blue with effect NoSchedule will be scheduled on it.

kubectl taint nodes arch app=blue:NoSchedule
node/arch tainted

Other taint effect options:

• NoSchedule
• PreferNoSchedule
• NoExecute

Create a corresponding pod with tolerations

apiVersion: v1
kind: Pod
metadata:
  labels:
    run: nginx-controller
  name: nginx-controller
spec:
  containers:
  - image: nginx
    name: nginx-controller
  tolerations:
  - effect: NoSchedule
    key: app
    operator: Equal
    value: blue

Here is another practical example. First, taint the node, then create a pod with the matching toleration so it can be scheduled on the tainted node.

kubectl taint node node01 spray=mortein:NoSchedule
node/node01 tainted

 cat bee.yaml
apiVersion: v1
kind: Pod
metadata:
  labels:
    run: bee
  name: bee
spec:
  containers:
  - image: nginx
    name: bee
  tolerations:
  - effect: "NoSchedule"
    key: "spray"
    value: "mortein"
    operator: "Equal"

Untaint controlplane in Katacoda

To allow regular workloads to be scheduled on the controlplane node, remove the taint by appending a - to the taint key.

kubectl taint node  controlplane node-role.kubernetes.io/master:NoSchedule-node/controlplane untainted